🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1c3eeb573dc5bc74ca1ce3cb1e9a2d7b26102ae6dbde1df38f0536e28eb9c805. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1c3eeb573dc5bc74ca1ce3cb1e9a2d7b26102ae6dbde1df38f0536e28eb9c805
SHA3-384 hash: da9a94efef82e39f21a3f2f3d4e012e96786b7dbf8e144c477786eee7e98bda2552a953edefb05d34897f33f668932c0
SHA1 hash: c673d4f0c8e69d6afeb01a85e810597afcbace4a
MD5 hash: b784829629097ee2701c43d390024e4c
humanhash: pennsylvania-connecticut-bakerloo-one
File name:nextUsDe.jpg
Download: download sample
Signature TrickBot
Create hunting rule
File size:577'666 bytes
First seen:2021-09-13 22:15:44 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 2447835d91955d5899b703294ffbcca5 (5 x TrickBot)
ssdeep 12288:5YzxeJ5ui1dZLGCD8atyw1L5+xWQaO76Et:5weTuqrLGK0I9AasL
Threatray 3'424 similar samples on MalwareBazaar
TLSH T11BC4CF0236E1C47AC5EE273459A35B1932F9FC114A76C287A745FA4E5E333C29C3A35A
dhash icon 0000000000000000 (907 x AgentTesla, 573 x Formbook, 316 x RedLineStealer)
Reporter malware_traffic
Tags:dll Shathak TA551 TrickBot


Avatar
malware_traffic
Run method: regsvr32.exe [filename]

Intelligence

File Origin
# of uploads :
1
# of downloads :
262
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/187593/
Detection(s):
SecuriteInfo.com.ML.PE-A.4109.28133.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware keylogger overlay packed
Link:
https://www.filescan.io/uploads/61750697db358dd15ed91e88/reports/11ccf32e-adc9-4f3d-8403-6c54773c324e/overview
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/a4ef83b6-a5a0-4628-8740-6b09d80ca3cc
Result
Threat name:
TrickBot
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/850218
Signature
Allocates memory in foreign processes
Delayed program exit found
Early bird code injection technique detected
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Found malware configuration
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sigma detected: Regsvr32 Command Line Without DLL
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Yara detected Trickbot
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 482644 Sample: nextUsDe.jpg Startdate: 14/09/2021 Architecture: WINDOWS Score: 100 62 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->62 64 Found malware configuration 2->64 66 Multi AV Scanner detection for submitted file 2->66 68 2 other signatures 2->68 8 loaddll32.exe 1 2->8         started        11 regsvr32.exe 2->11         started        13 rundll32.exe 2->13         started        process3 signatures4 70 Writes to foreign memory regions 8->70 72 Allocates memory in foreign processes 8->72 15 regsvr32.exe 8->15         started        18 cmd.exe 1 8->18         started        20 rundll32.exe 8->20         started        22 2 other processes 8->22 process5 dnsIp6 84 Writes to foreign memory regions 15->84 86 Allocates memory in foreign processes 15->86 88 Queues an APC in another process (thread injection) 15->88 25 wermgr.exe 15->25         started        90 Early bird code injection technique detected 18->90 29 rundll32.exe 18->29         started        31 wermgr.exe 20->31         started        42 179.42.137.109, 443, 49904, 49907 TelefonicadeArgentinaAR unknown 22->42 44 171.103.187.218, 449, 49980 TRUEINTERNET-AS-APTRUEINTERNETCoLtdTH Thailand 22->44 46 5 other IPs or domains 22->46 33 iexplore.exe 150 22->33         started        signatures7 process8 dnsIp9 48 191.36.152.198, 443, 49942, 49945 VIPTURBOCOMERCIOSERVICOSDEINFORMATICALTDABR Brazil 25->48 50 179.42.137.107, 443, 49834, 49835 TelefonicadeArgentinaAR unknown 25->50 58 2 other IPs or domains 25->58 74 Tries to detect virtualization through RDTSC time measurements 25->74 76 Found evasive API chain (trying to detect sleep duration tampering with parallel thread) 25->76 78 Writes to foreign memory regions 29->78 80 Allocates memory in foreign processes 29->80 82 Delayed program exit found 29->82 35 wermgr.exe 29->35         started        52 179.42.137.104, 443, 49900, 49901 TelefonicadeArgentinaAR unknown 31->52 54 202.183.12.124, 443, 49949 MILCOM-AS-APMilcomCoLtdInternetServiceProviderBang Indonesia 31->54 56 edge.gycpi.b.yahoodns.net 87.248.118.22, 443, 49828, 49829 YAHOO-DEBDE United Kingdom 33->56 60 13 other IPs or domains 33->60 signatures10 process11 dnsIp12 38 186.4.193.75, 443, 49948, 49956 TelconetSAEC Ecuador 35->38 40 194.190.18.122, 443, 49887, 49891 KTTRADE-ASRU Russian Federation 35->40
Detection:
trickbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/1c3eeb573dc5bc74ca1ce3cb1e9a2d7b26102ae6dbde1df38f0536e28eb9c805/
Verdict:
malicious
Label(s):
trickbot
Create hunting rule
Similar samples:
074b3d896e53fc8335cdea4b0f565e01b99ee9041c01d9c17a23f67409b138c1
TrickBot
07d1bd48ef3b4baf2e8498b3a2dc406c533c90bce7a2cb963506b6889330c020
TrickBot
096691e267868f40153264181ee8550a4537688fd4c98acb6af775c3c4ba0ebd
TrickBot
0fae415c360c5be4b6b2a2e83c11b2b9d05afd5e3c98074328637e05164c96b3
TrickBot
367cd9c4f987db35c45539316388a22110adff7b0d0e51f63ceb4034a0037bfb
TrickBot
56c0dbbb56ab9b63c997eb80beb6392b50d507e4dc08ce617d32b8563fbd54ce
TrickBot
9dbffb4b069247648835fbdbc7ee71d467ee258a37b05797e83facfe53e61015
TrickBot
+ 3'414 additional samples on MalwareBazaar
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:zev4 banker trojan
Link:
https://tria.ge/reports/210913-16splseea9/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Looks up external IP address via web service
Trickbot
Malware Config
C2 Extraction:
179.42.137.102:443
191.36.152.198:443
179.42.137.104:443
179.42.137.106:443
179.42.137.108:443
202.183.12.124:443
194.190.18.122:443
103.56.207.230:443
171.103.187.218:449
171.103.189.118:449
18.139.111.104:443
179.42.137.105:443
186.4.193.75:443
171.101.229.2:449
179.42.137.107:443
103.56.43.209:449
179.42.137.110:443
45.181.207.156:443
197.44.54.162:449
179.42.137.109:443
103.59.105.226:449
45.181.207.101:443
117.196.236.205:443
72.224.45.102:449
179.42.137.111:443
96.47.239.181:443
171.100.112.190:449
117.196.239.6:443
Unpacked files
SH256 hash:
961f1781eea66f48c3c377c822824a69d2e49aa51dc536a77480ceef242e7c30
MD5 hash:
b0f610af180f5ba8800ab86d642a007c
SHA1 hash:
fad624004fd87a9b101eee309de8f18bc96a72d0
Link:
https://www.unpac.me/results/8b0e859a-fc8b-4e80-936f-8b6fe30ac611/
SH256 hash:
21edebc9a450956047cb46217e7032b623b6b07d337eea24f92b3200c5bdada5
MD5 hash:
bbf41b475ba2243c1563e656fec89365
SHA1 hash:
b6484c74a8bd6934fb4c17bdea2b809fc142281f
Link:
https://www.unpac.me/results/8b0e859a-fc8b-4e80-936f-8b6fe30ac611/
SH256 hash:
3e4fc3d8c5f8870717efaed16e99fd0d22a67ad962f9db98554359013cd9e955
MD5 hash:
894fc0425028a4f0df7af0adc66823c3
SHA1 hash:
7b3c9eea1466be95d5e3daeba870c7be2a83db70
Detections:
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/8b0e859a-fc8b-4e80-936f-8b6fe30ac611/
Parent samples :
074b3d896e53fc8335cdea4b0f565e01b99ee9041c01d9c17a23f67409b138c1
0fae415c360c5be4b6b2a2e83c11b2b9d05afd5e3c98074328637e05164c96b3
1c3eeb573dc5bc74ca1ce3cb1e9a2d7b26102ae6dbde1df38f0536e28eb9c805
07d1bd48ef3b4baf2e8498b3a2dc406c533c90bce7a2cb963506b6889330c020
096691e267868f40153264181ee8550a4537688fd4c98acb6af775c3c4ba0ebd
SH256 hash:
2d4ad904c75d895715b5c89fe28231f5bd25503e775670fc9b4187b8bef14d82
MD5 hash:
ced9f9ed8da5a64a0eff9bf55ed82811
SHA1 hash:
00891b83b35e722c8e4eed99fa9045727c8f64d2
Link:
https://www.unpac.me/results/8b0e859a-fc8b-4e80-936f-8b6fe30ac611/
SH256 hash:
1c3eeb573dc5bc74ca1ce3cb1e9a2d7b26102ae6dbde1df38f0536e28eb9c805
MD5 hash:
b784829629097ee2701c43d390024e4c
SHA1 hash:
c673d4f0c8e69d6afeb01a85e810597afcbace4a
Link:
https://www.unpac.me/results/8b0e859a-fc8b-4e80-936f-8b6fe30ac611/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/1c3eeb573dc5/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1c3eeb573dc5bc74ca1ce3cb1e9a2d7b26102ae6dbde1df38f0536e28eb9c805

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/187593/

Comments